OpenAI cheated on its homework. It's just the start

This week OpenAI admitted that a pair of its models - one of them not yet released - broke out of a sandboxed testing environment and hacked Hugging Face, one of the biggest AI platforms in the world. They found their way onto the internet, got in through a weakness in a data-processing pipeline, and worked through the internal systems from there. Nobody instructed them to do any of it.

The break-out is the headline. But buried in OpenAI's own account is the more interesting detail: the reason.

The models were sitting a test of their cyber capabilities, and somewhere mid-exam one of them concluded that the fastest way to pass was to go and find the answers. So it did. It broke into the platform where the material lived and took what it needed.

We can all recognise the move. This is a teenager cheating on their homework, except this student picked the lock at the exam board's office, and did it well enough that the people who set the exam are calling it unprecedented.

Hugging Face took it in good humour. Their CEO said nobody believes there was any malicious intent, and that it was mind-blowing to watch it all happen autonomously. I believe that too. But intent was never the interesting question.

The whole point is that it decides

None of this is a malfunction. The entire point of agentic AI is that the agent decides how best to solve the problem you hand it.

An agent doesn't know why a rule exists, and it makes no moral judgement about it. Tell it route X is blocked and it will try route Y. We can keep putting barriers on the road. Agentic AI will keep building new roads if it decides that's the right approach.

So the two narratives doing the rounds this week are both wrong. One says avoid this technology until somebody makes it safe. The other says relax, the vendors will add better guardrails. Guardrails assume you know where the road is. The defining skill of a frontier model is finding the route you didn't think to block.

You can't have your cake and eat it

If you want something close to a true general intelligence, you can't at the same time insist you'll keep total control of it. A model clever enough to solve anything is clever enough to treat the box you've put it in as part of the problem. The frontier labs are racing for exactly that kind of intelligence, which means stories like this one will keep coming. I'd suggest getting used to them.

The question worth considering when thinking about AI in your own business is simpler: how much of that genius does the work actually require?

Your admin doesn't need a genius

Most of the jobs a business would hand to an agent - chasing documents, onboarding clients, moving candidate data between systems, keeping records straight - need none of that brilliance. They need a smaller, specialised model: everything the task requires, and nothing it doesn't. A specialist doing one job to a written spec has no reason to go looking for new roads

We've run this experiment before, in physical form. Tesla and half of Silicon Valley are spending billions on humanoid robots, general-purpose machines that could in principle do anything a person can. Meanwhile, factories have collected the benefits of robotic automation for forty years, precisely because their robots were specialised and focused on the job in front of them. The arm that welds the car never needed to know how to drive it.

What harnessing this actually looks like

An Agent Resource - an AI member of your team that sits alongside your human resources - should run on the smallest model that will do its job well, inside a managed harness that watches it work. Every action it takes lands in an audit trail. Its access is scoped to the systems its role actually needs. And some rules are hard ones, for example: nothing gets written into a client's live system until a human has confirmed it. The agent earns wider access the way a new starter does, by doing the job well under supervision.

It is unglamorous engineering, and it is exactly the part that was missing from the sandbox OpenAI's models climbed out of.

So when somebody offers to wire AI into your business, the question has moved on from "is it safe?". Ask why the task needs a model that clever. Ask what happens when it improvises. Ask who confirms its work before anything touches a live system.

Most businesses need an agent who drives the same roads, day after day - predictable, reliable and reassuringly dull; they don't need them to build new ones.